CVE-2022-29237: Limited Authentication Bypass for Media Files in org.opencastproject:opencast-ingest-service-impl
Summary
CVE-2022-29237: Limited Authentication Bypass for Media Files. Affects org.opencastproject:opencast-ingest-service-impl across 2 version ranges.
< 10.14
>= 11.0, < 11.7
Fixed in 10.14 or 11.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.opencastproject:opencast-ingest-service-impl package is a Maven package that provides the ingest service implementation for the Opencast system. Opencast is an open-source platform designed for managing and distributing academic video content. The ingest service is responsible for importing media files into the Opencast system. This package is vulnerable to a limited authentication bypass for media files.
Vulnerability Detail
The vulnerability in org.opencastproject:opencast-ingest-service-impl allows users to pass URLs for files belonging to other organizations, bypassing organizational barriers. This means that an attacker with full access to Opencast's ingest REST interface and knowledge of internal links to resources in another organization of the same Opencast cluster can import those files into their own organization. The impact of this vulnerability is the ability for attackers to bypass organizational barriers within Opencast.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 10.1410.14 -
>= 11.0, < 11.711.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the patched versions of Opencast.
Conclusion
The vulnerability in org.opencastproject:opencast-ingest-service-impl allows for a limited authentication bypass for media files, enabling attackers to import files from other organizations. To mitigate this vulnerability, it is crucial to update to Opencast version 10.14 or 11.7, which include the necessary patches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opencastproject:opencast-ingest-service-impl →
FAQ
The vulnerability allows attackers to bypass organizational barriers within Opencast, potentially accessing and importing files from other organizations.
This vulnerability affects users of Opencast versions prior to 10.14 and 11.7. If you do not run a multi-tenant cluster, you are not affected.
To mitigate the risk, it is recommended to update to Opencast version 10.14 or 11.7, which include the necessary patches.
There are no known workarounds for this vulnerability. Updating to the patched versions is the recommended solution.
For more information, you can open an issue in the Opencast issue tracker or email security@opencast.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opencastproject:opencast-ingest-service-impl.
